Skip to main content

Require 2FA, API Tokens, and Security Log

Requiring 2FA for the shop's owner accounts​

In Settings > Security, turn on Require 2FA for owner accounts and choose a grace period of 0 to 30 days. It is off by default. Turning it on or changing the grace period starts the countdown from that moment.

Require 2FA for owner accounts: the switch and grace period, then a timeline from the grace period with its countdown banner to after the deadlineRequire 2FA for owner accountsOwners without 2FA get a grace period, then can only reach the setup screen.Grace period (days)7Enforced from 19 Oct 2026 10:00Save12 Oct 2026Requirement switched on19 Oct 2026DeadlineGrace periodSigns in and works as usual, with a banner:Your shop requires two-factor authentication.5 day(s) left to set it up.Set up nowAfter the deadlineSettings-only session until 2FA is on:Other pages are refusedDashboard opens the 2FA setupAlready on 2FA? Nothing changes.123
Turn on (1) the switch and pick a grace period. During the grace period owners see (2) a countdown banner with Set up now; after the deadline (3) only settings can be opened.

Turn on (1) the switch and pick a grace period. During the grace period owners see (2) a countdown banner with Set up now; after the deadline (3) only settings can be opened.

Owner account stateWhat happens
Already has 2FA, or the shop does not require itNo change
Grace period (no 2FA yet)Can sign in and work normally. A banner with a countdown and a Set up now button appear
After the deadlineCan sign in, but the session is setup-only: every other page is refused until 2FA is active, and the Dashboard opens the setup wizard right away

As soon as 2FA is activated, the restriction lifts immediately. Sessions already running are re-evaluated when they renew, so the deadline can take effect after that. Guide: Enabling Two-Factor Authentication.

API tokens and MCP clients​

Personal access tokens (eta_pat_...) work as before and are never asked for a 2FA code when used. Because tokens do not end with sessions, creating one is the protected moment:

  • If 2FA is on, the Create token dialog asks for a 2FA code (app code or recovery code). Without a code creation is refused; a wrong code is refused; when locked, the remaining wait is shown.
  • A token cannot create new tokens. A leaked token cannot be used to mint others.
  • Accounts without 2FA: nothing changes.
  • Listing and revoking tokens needs no extra code.
  • Changing your password does not revoke tokens. After a suspected compromise, revoke tokens manually in Settings > API tokens.
  • Token, staff, and impersonation credentials cannot open the Security and Sessions pages.

MCP clients: if your MCP client signs in with email and password on a 2FA account, it is asked for a code and cannot proceed. Switch it to a personal access token or OAuth. See Integrations and OAuth Setup.

Security emails​

Etalasse sends emails (with no codes inside) when: 2FA is enabled or disabled, recovery codes are regenerated, the password is changed or reset, other devices are signed out, 2FA is reset by support, and a sign-in comes from a new device.

Trail in the Activity Log​

Every security change is recorded in the Activity Log under the security resource. Entries never contain keys, codes, or passwords.

FAQ​

Is 2FA mandatory?​

No, unless the owner turns on require 2FA for the shop.

Does my staff need 2FA?​

No. 2FA is for owner accounts only. Staff logins do not change.

Will this sign me out after the release?​

No. Existing sessions stay valid until they expire and migrate to the new system on their own.

I changed phones. What should I do?​

Move the account in your authenticator app, or disable and re-enable 2FA on the new phone. See Lost Phone or Locked Out.

My code is rejected even though it is correct.​

Check your phone's clock (set it to automatic), and remember a code that was already used cannot be used again: wait for the next one. After 10 wrong attempts the account is locked for 15 minutes.

Does the mobile dashboard have the same features?​

The Settings > Security page is designed for both the web Dashboard and the mobile app.